Splunk Search

Total a field in a transaction

approachct
Path Finder

I have a transaction that is tied together based on IP address in a web server log. The IP is c_ip and the search would look something like the below -

index=iis sourcetype=iis-w3c (cs_method=POST cs_uri_stem=/page1) OR (cs_uri_stem=/page2) | transaction c_ip maxspan=12s startswith="cs_method=POST cs_uri_stem=/pagea" endswith="cs_method=GET cs_uri_stem=/pageb" | search linecount>1 duration="1"

There is a field that exists in each log entry called time_taken. I would like to create a value called TotalTime= time_taken of PageA + time_taken of PageB of the defined transaction. How do I do this? Basically how to I get the value of a field that exists in each log entry inside a transaction when they both have the same name?

Thanks

Tags (1)
0 Karma

bbingham
Builder

if the values are marked as multivalue fields, you can pass them through the transaction command using the mvlist flag. After they are both listed on the transaction, you can then use streamstats to add them even-though they are the same name.

index=iis sourcetype=iis-w3c (cs_method=POST cs_uri_stem=/page1) OR (cs_uri_stem=/page2) 
| transaction c_ip maxspan=12s startswith="cs_method=POST cs_uri_stem=/pagea" endswith="cs_method=GET cs_uri_stem=/pageb"  mvlist=time_taken
| streamstats sum(time_taken) as Total_Time_Taken window=1

this would mean if page1 has time_taken=1 and page2 has time_taken=2, the resulting transaction will have 2 time_taken fields, one marked 1 and one marked 2. Streamstats will then create a new field "Total_Time_Taken" and add all occurrences of "time_taken", resulting in a value of 3.

stefano_guidoba
Communicator

thanks pal, this solved precisely my issue :slightly_smiling_face:

acdevlin
Communicator

Just to double-check: Is pageA always guaranteed to be the first event in the transaction and pageB always guaranteed to be the last?

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...